Policies

1. Introduction

This privacy policy explains how I collect, use, store, and protect your personal data as part of the therapy intake process and ongoing therapeutic work.

It is written to support informed consent and transparency, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and UK Council for Psychotherapy (UKCP) ethical requirements.

I am committed to protecting your privacy and handling your personal information with care, clarity, and respect.

2. Data Controller

I am the data controller for the personal data I hold as a sole practitioner.

Name: Fiona Murray
Professional role: Psychotherapist / Counsellor/Coach/ Personal Consultant (Sole Practitioner)
Email: FMAM@aol.com
Practice: Private practice

I am registered with the Information Commissioner’s Office (ICO).

3. What Information I Collect

As part of the intake process and ongoing therapy, I may collect and store the following types of personal data:

Your name and contact details (email address, phone number)
Emergency contact details
GP name and practice details
Intake and assessment information
Brief clinical notes relating to sessions
Correspondence relating to therapy (emails or messages)
Payment and invoicing records
Information relevant to online sessions (such as session times and platform used)

I only collect information that is necessary to provide psychotherapy safely, ethically, and in line with professional and insurance requirements.

4. Lawful Basis for Processing

Under UK GDPR, the lawful bases I rely on for processing personal data are:

Contract: to provide psychotherapy/counselling/coaching/personal consultancy services
Legal obligation: to meet professional, ethical, and insurance requirements
Legitimate interests: for safe and effective therapeutic practice
Vital interests: if there is a serious risk to your life or the life of another
Consent: where required (for example, contacting a GP outside of emergency situations)

5. How Your Information Is Used

Your information is used to:

Provide psychotherapy/counselling/coaching/personal consultancy sessions
Maintain safe and effective practice
Manage appointments and communication
Meet UKCP, insurance, and legal requirements
Respond appropriately to risk or safeguarding concerns

I do not sell, trade, or share your personal data for marketing purposes.

6. Confidentiality and Its Limits

Confidentiality is a fundamental part of therapy. Your information will not be shared without your consent except in the following circumstances:

If there is a serious risk of harm to you or another person
If there are safeguarding concerns involving children or vulnerable adults
If disclosure is required by law (e.g. court order)
If required by my professional body or insurer

Where possible, I will aim to discuss any need to share information with you beforehand.

7. Online Therapy and Digital Data

For online work:

Sessions are conducted using secure, reputable platforms
Sessions are not recorded
Emails and messages are used for practical communication only

Please note that while I take steps to ensure digital security, online communication can never be completely risk-free.

8. Data Storage and Security

As a sole practitioner, I am solely responsible for the secure handling of your personal data.

Your data is stored securely:

Electronic records are password-protected and encrypted where possible
Devices used for work are protected with passwords and security updates
Paper records (if any) are kept in a locked cabinet
Access to your data is restricted to me only

I take reasonable steps to protect your information from loss, misuse, or unauthorised access.

9. How Long I Keep Your Data

In line with UKCP and insurance guidance:

Adult client records are retained for 7 years after the end of therapy
Records for children and young people are retained until age 25 (or 26 if therapy ended at 17)

After this period, data is securely deleted or destroyed.

10. Your Rights and Consent

Under UK GDPR, you have the right to:

Access the personal data I hold about you
Request correction of inaccurate data
Request erasure (where applicable)
Request restriction of processing
Object to processing
Request data portability
Withdraw consent (where consent is the lawful basis)

To exercise these rights, please contact me using the details above.

11. Complaints

If you have concerns about how your data is handled, please raise them with me in the first instance.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk

12. Changes to This Policy

This privacy policy may be updated from time to time to reflect changes in legal or professional requirements. The most current version will always be available on request.

Last updated: February 2026

Confidentiality Policy

1. Purpose

This Confidentiality Policy sets out how confidentiality is maintained, protected, and ethically managed in accordance with the UK Council for Psychotherapy (UKCP) Ethical Principles and Code of Professional Conduct, the British Association for Counselling and Psychotherapy (BACP) Ethical Framework, and applicable UK law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The aim of this policy is to ensure that clients understand how their personal information is handled and the circumstances under which confidentiality may be limited.

2. Scope

This policy applies to all services provided by Fiona Murray Therapy, a private practice offering counselling, psychotherapy, coaching, and personal consultancy, including:

Individual psychotherapy and counselling
Assessment sessions
Online, telephone, and face-to-face work
Clinical records, correspondence, and digital data

3. Definition of Confidentiality

Confidentiality refers to the ethical and legal duty to protect information disclosed by clients during the course of therapy. All personal information shared within the therapeutic relationship is treated as confidential and is not disclosed to third parties without the client’s consent, except in specific circumstances outlined in this policy.

4. Commitment to Confidentiality

In line with UKCP and BACP ethical principles of trust, respect, integrity, and professional responsibility, Fiona Murray Therapy is committed to:

Respecting client privacy and dignity
Safeguarding all personal and sensitive information
Being transparent about the limits of confidentiality
Handling information lawfully, fairly, and securely

5. Limits to Confidentiality

Confidentiality is not absolute. Disclosure of confidential information may occur without client consent in the following circumstances:

5.1 Risk of Serious Harm

If there is reasonable concern that the client poses a serious risk of harm to themselves or others, confidentiality may be breached in order to safeguard life. Only relevant information will be disclosed, and wherever possible, this will be discussed with the client beforehand.

5.2 Safeguarding Concerns

If there is a safeguarding concern involving a child, young person, or vulnerable adult, information may be shared with appropriate safeguarding authorities in accordance with statutory requirements.

5.3 Legal Requirements

Confidential information may be disclosed if required by law, including:

Court orders or subpoenas
Serious crime prevention or investigation

5.4 Professional Supervision

Client work is discussed in confidential clinical supervision as required by UKCP training standards and BACP accreditation requirements. Identifying details are anonymised wherever possible, and supervisors are bound by the same standards of confidentiality.

6. Client Consent

Confidentiality and its limits are explained at the start of therapy and revisited as needed.
Written or verbal consent will be sought before sharing information with third parties (e.g., GPs or other professionals), unless an exception outlined above applies.

7. Record Keeping

Accurate and appropriate records are maintained in line with UKCP guidance and BACP accreditation requirements.
Records may include session notes, assessments, correspondence, and administrative information.
Notes are factual, respectful, and relevant to therapeutic work.

8. Data Protection and Storage

All personal data is handled in accordance with UK GDPR and the Data Protection Act 2018.

8.1 Storage

Paper records are stored securely in locked storage.
Electronic records are stored on password-protected, encrypted devices or secure systems.

8.2 Retention

Records are retained only for as long as necessary and in accordance with professional and legal guidelines.
Records are securely destroyed once the retention period expires.

8.3 Client Access

Clients have the right to request access to their personal data in line with data protection legislation, subject to limited legal and ethical exemptions.

9. Confidentiality in Online and Remote Work

Reasonable steps are taken to ensure privacy and security in online and telephone sessions.
Clients are encouraged to ensure they are in a private space during remote sessions.
Digital communication is kept to a minimum and used primarily for administrative purposes.

10. Breaches of Confidentiality

Any actual or suspected breach of confidentiality will be taken seriously and addressed promptly, including:

Assessing risk and impact
Informing affected parties where appropriate
Taking steps to prevent recurrence

11. Complaints

Clients who have concerns about confidentiality are encouraged to raise them directly with Fiona Murray Therapy. Clients also have the right to follow the UKCP complaints procedure if concerns cannot be resolved locally.

12. Professional Status and Review of Policy

12.1 Professional Status

The practitioner works in private practice as a UKCP trainee psychotherapist and is a BACP-accredited practitioner. All services are delivered in accordance with the scope of training, competence, and ongoing professional development requirements of both organisations.

13. Review of Policy

This policy is reviewed regularly to ensure ongoing compliance with UKCP standards, legal requirements, and best practice.

Last reviewed: February 2026

Next review due: February 2027